Multi-account application system integration method and system based on unified user authentication

Abstract

The invention discloses a multi-account application system integration method and system based on unified user authentication, and belongs to the technical field of information security. The method comprises the key steps that a user sends an access request through a client; when the user does not log in, the client automatically requests a unified authentication service; after the user identity authentication succeeds, the service generates an authentication mark containing user information; the service determines user access authority; the client carries the authentication mark to access the application; the application verifies the validity of the mark and provides a service; and after the identity verification succeeds, the service associates the account information with the authentication mark. According to the invention, the information description and authentication of the used application system account are added in the unified authentication and authentication process, so that the application system can identify different application accounts used by the user, and the user does not need to switch the application accounts under the scene that the unified user has a plurality of application accounts; better use experience of the user is brought; unauthorized access is avoided, and the security of the system is ensured.

Description

Technical Field

[0001] The present invention belongs to the field of information security technology, and specifically relates to a multi-account application system integration method and system based on unified user authentication. Background Art

[0002] The core of users using unified authentication to achieve integrated access across applications is the Single Sign On technology, which has two main components: a unified authentication system and an application system that can identify authentication information. The main function of the unified authentication system is to compare the user's login information with the user information database and authenticate the user's login; after successful authentication, the authentication system should generate a unified authentication token and return it to the user. In addition, the authentication system should also verify the authentication token to determine its validity. At the same time, to realize the SSO function and allow users to log in only once, the application system must be able to identify users who have already logged in. The application system should be able to identify and extract the authentication token, and through communication with the authentication system, it can automatically determine whether the current user has logged in, thereby completing the single sign-on or allowing the user to log in again.

[0003] The unified authentication system is the most common user account integration solution for enterprise applications. Through unified authentication, different accounts in various application systems are connected, so that users do not need to repeatedly enter usernames and passwords when switching between different systems. Unified user authentication is based on this, taking users as the basis for application integration. In actual use, it is often the case that users have multiple accounts in a certain application system. When using an application system with multiple accounts, users need to select the account they use before they can access the application system, which brings a lot of inconvenience to many users with multiple accounts. In the scenario of unified to-do integration, users cannot integrate into other systems by directly jumping. Summary of the invention

[0004] In response to the above problems, the present invention provides a multi-account application system integration method and system based on unified user authentication, which solves the inconvenience of users having to repeatedly log in and manually switch accounts in traditional multi-account application systems, as well as the technical problem of being unable to achieve direct jump access in a unified to-do integration scenario. By realizing single sign-on and automatic processing of user account information, the user experience is optimized and the system security is enhanced.

[0005] To achieve the above object, the technical solution adopted by the present invention is:

[0006] A method for integrating a multi-account application system based on unified user authentication comprises the following steps:

[0007] a. The user initiates an access request to the integrated application through the client;

[0008] b. The client detects that the user is not logged in and automatically sends a login request to the unified authentication service;

[0009] c. The user authenticates his / her identity in the unified authentication service. After successful authentication, the unified authentication service generates an authentication token containing user information and session identifier;

[0010] d. The unified authentication service determines the user's access rights to the application based on the user request and user information;

[0011] e. The client carries the authentication token to access the integrated application;

[0012] f. The integrated application receives the authentication mark, verifies the validity of the authentication mark through interaction with the unified authentication service, and provides corresponding services based on the verification results;

[0013] g. After the user's identity is successfully authenticated, the unified authentication service associates the user's account information with the authentication token and provides it to the client.

[0014] The beneficial effects of this technical solution are: achieving seamless access experience for users in multiple application environments, significantly reducing the complexity of user operations by eliminating repeated login steps. In addition, through the centralized management of unified authentication services, account security and data protection are enhanced, and system resource consumption for multi-account management is reduced.

[0015] In a preferred implementation, the specific implementation of the client detecting the user login status in step b is:

[0016] i. The client checks the locally stored session information;

[0017] ii. If the session information exists and has not expired, the user is considered to have logged in;

[0018] iii. If the session information does not exist or has expired, it is considered that the user is not logged in.

[0019] The beneficial effects of the above implementation are:

[0020] Through the rapid detection of local session information, the reliance on the unified authentication service and the delay of network communication are reduced, providing users with instant login status feedback. This mechanism optimizes the user experience, especially in environments with unstable networks or high latency. The detailed working principle adopted is: the client uses the locally stored session information and timestamp to quickly determine the user's login status by comparing the current time and the session expiration time. This method reduces the requests to the central authentication service, reduces the system load and response time.

[0021] In a preferred implementation, the specific implementation of the unified authentication service generating an authentication token in step c includes:

[0022] i. Generate an authentication token containing the user's unique ID and session validity period based on the user's identity authentication result;

[0023] ii. Encrypt the authentication mark to ensure the security of the transmission process.

[0024] The beneficial effects of the above implementation are:

[0025] By encrypting the authentication mark, a high standard of protection for user identity information is provided, preventing potential eavesdropping and tampering risks during transmission. It enhances user trust in system security and meets the needs of higher security standards. Working principle: After the unified authentication service generates the authentication mark, it applies advanced encryption algorithms to encrypt it, ensuring the confidentiality and integrity of the authentication mark. Only entities with the correct key can decrypt and verify the authentication mark, thus ensuring the security of the authentication process.

[0026] In a preferred implementation, the specific implementation of the unified authentication service determining the user access rights in step d is as follows:

[0027] i. Query the user permission database to obtain the user's access permission records for each application;

[0028] ii. Determine whether the user has the right to access the application based on the application requested by the user and the user's permission record.

[0029] The beneficial effects of the above implementation are:

[0030] Through precise permission management, only authorized users can access specific applications, thereby protecting sensitive data and resources from unauthorized access. This approach improves the security and compliance of the system. How it works: The unified authentication service implements fine-grained access control by querying the user permission database, obtaining the user's access permission record, and matching it with the application requested by the user. This approach allows the system to dynamically adjust access permissions based on the user's role and permissions.

[0031] In a preferred implementation, when the client carries the authentication mark to access the integrated application in step e, the specific measures to ensure the secure transmission of the authentication mark are:

[0032] i. Use secure communication protocols (such as HTTPS) for data transmission;

[0033] ii. The authentication mark is encrypted again to prevent it from being intercepted during transmission.

[0034] The beneficial effects of the above implementation are:

[0035] By using secure communication protocols and re-encrypting the authentication mark, end-to-end data protection is provided to ensure the security of authentication information during the entire network transmission process. The working principle is: secure communication protocols such as HTTPS are used between the client and the integrated application for data transmission, and the authentication mark is re-encrypted to ensure that even if the data is intercepted, it cannot be decrypted and understood by unauthorized third parties.

[0036] In a preferred implementation, the specific implementation of the integrated application verification authentication mark validity in step f is:

[0037] i. Verify the format and signature of the certification mark;

[0038] ii. Communicate with the unified certification service in real time to confirm the current status and validity of the certification mark.

[0039] The beneficial effects of the above implementation are:

[0040] By verifying the validity of the authentication mark in real time, the system's access control is ensured to always be up to date, and the user's login and logout events are responded to in a timely manner, thereby preventing session hijacking and replay attacks. The working principle adopted is that the integrated application verifies the format and signature of the authentication mark and communicates with the unified authentication service in real time to confirm the current status of the authentication mark. This method provides a dynamic security mechanism that can adapt to changes in user behavior and system status.

[0041] The present invention also provides a multi-account application system integration system based on unified user authentication, comprising the following components:

[0042] a. Unified authentication service, used to handle user identity verification and the generation and verification of authentication marks;

[0043] b. Client, used for interaction between users and integrated applications, including sending login requests and carrying authentication tokens;

[0044] c. The integrated application is used to receive the client's request, verify the authentication mark, and provide corresponding services;

[0045] d. Application system adapter, used to achieve adaptation and communication with unified authentication services without modifying the core logic of the existing application system.

[0046] The beneficial effects of this system are:

[0047] By building an integrated system with key components, a modular and scalable solution is provided to support the rapid integration and unified management of different application systems. The working principle adopted is: this system consists of a unified authentication service, client, integrated application and application system adapter, and each component has clear responsibilities and functions. This design allows the system to flexibly adapt to different application scenarios and requirements while maintaining the consistency and security of the system.

[0048] In the best implementation, the unified authentication service includes the following sub-modules:

[0049] a. User identity verification module, used to verify the user's identity information;

[0050] b. An authentication mark generation module for generating an authentication mark containing user information;

[0051] c. Permission management module, used to manage user access rights to various applications;

[0052] d. Application system account mapping module, used to map the user's unified authentication information to a specific application system account and realize transparent transmission of account information.

[0053] The beneficial effects of the above implementation are:

[0054] The sub-modular design of the unified authentication service improves the maintainability and scalability of the system, allowing each functional module to be updated and optimized independently without affecting the stability of the entire system. The working principle adopted is: the unified authentication service consists of a user identity authentication module, an authentication mark generation module, a permission management module, and an application system account mapping module. Each module is responsible for handling specific tasks and interacts with other modules through well-defined interfaces, ensuring the flexibility and scalability of the system.

[0055] The present invention further provides a computer program product for implementing a multi-account application system integration method based on unified user authentication, the product comprising:

[0056] a. a storage medium for storing computer-readable instructions;

[0057] b. Computer-readable instructions for implementing the steps in the above method, including user identity authentication, authentication mark generation, authority determination, secure transmission and authentication mark verification.

[0058] The beneficial effects of the computer program product are:

[0059] The introduction of computer program products enables the integration method to be implemented and distributed in the form of software, which is convenient for deployment and execution in different computing environments, and improves the popularity and practicality of the method. The computer program product includes a storage medium and computer-readable instructions, which implement the steps of user identity authentication, authentication mark generation, authority judgment, secure transmission and authentication mark verification in detail, so that the integration method can run efficiently on various hardware platforms.

[0060] The present invention also provides a computer system for implementing a multi-account application system integration method based on unified user authentication, comprising:

[0061] a. at least one processor for executing instructions in a computer program product;

[0062] b. at least one memory for storing a computer program product;

[0063] c. Network communication module, used to realize data exchange between the client and the unified authentication service and the integrated application.

[0064] The beneficial effects of this system are:

[0065] The introduction of the computer system provides the necessary hardware foundation for the implementation of the integration method, ensuring the efficient execution and stable operation of the method, while supporting large-scale deployment and high-concurrency processing. The computer system includes a processor, memory, and network communication module. These hardware components work together to execute instructions in the program product, store necessary data, and realize high-speed data exchange between the client and the unified authentication service and the integrated application.

[0066] In a preferred implementation, the specific implementation of the client detecting the user login status in step b includes:

[0067] i. The client checks the locally stored session information;

[0068] ii. If the session information exists and has not expired, the user is considered logged in, where the expiration time of the session information is ΔT new Dynamic adjustment based on the following formula: ΔT new =ΔT old ·(1-α·Var(B user )), where ΔT old is the original session timeout threshold, α is the adjustment coefficient, Var(B user ) is the variance of user behavior data;

[0069] iii. If the session information does not exist or has expired, the user is considered not logged in and the re-login process is triggered;

[0070] iv. The client collects user behavior data Buser , including login frequency and usage duration, are used to calculate the stability index of user behavior and adjust the session timeout threshold accordingly to optimize user experience and improve system security.

[0071] The beneficial effects of the above implementation are: by analyzing user behavior patterns to optimize the session timeout threshold, more personalized and intelligent session management is achieved, and user satisfaction and system security are improved. The working principle adopted is: the client collects user behavior data, such as login frequency and usage time, and calculates the variance to evaluate the consistency of user behavior. Then, the session timeout threshold is dynamically adjusted according to the stability index of user behavior, providing longer session time for stable behavior patterns and shorter session time for unstable behavior patterns.

[0072] In a preferred implementation, when the unified authentication service generates the authentication mark in step c, a dynamic algorithm based on user behavior is used:

[0073] iii. The validity period TE of the certification mark is dynamically calculated according to the following formula: Where T base is the basic session time, w i is the weight coefficient, b i is the rating item based on user behavior, n: the total number of rating items.

[0074] The beneficial effects of the above implementation are:

[0075] The use of a dynamic algorithm based on user behavior to generate the certification mark makes the validity period of the certification mark more consistent with the actual usage of the user, improving the security and flexibility of the system. The working principle adopted is that when the unified authentication service generates the certification mark, it combines the user behavior scoring item and the weight coefficient to dynamically calculate the validity period of the certification mark. This method takes into account the diversity of user behavior and provides customized certification validity periods for different users and different usage scenarios.

[0076] In a preferred implementation, when the unified authentication service determines the user's access rights in step d, a permission weight allocation mechanism is adopted:

[0077] i. The access rights of each application are determined by the following formula: Where m is the number of permission categories, f i is the scoring function for the i-th category, C i is the user's cumulative rating in this category.

[0078] The beneficial effects of the above implementation are:

[0079] Through the permission weight allocation mechanism, the refined management of user access rights is achieved, making permission control more reasonable and personalized, and improving the security of the system and user satisfaction. The working principle adopted is: the unified authentication service calculates the access rights of each application based on the user's cumulative score and scoring function in different permission categories. This method allows the system to dynamically adjust the user's access rights according to the user's specific behavior and preferences, realizing personalized permission management.

[0080] In a preferred implementation, the data transmission between the client and the integrated application in step e adopts a secure transmission protocol based on risk assessment:

[0081] The choice of security protocol is determined by the following formula: protocol = argmax(S i ·R i ), where S i is the security score of protocol i, R i It is a risk assessment based on the current network environment. protocol : Select the secure transmission protocol, the best choice based on protocol security score and risk assessment.

[0082] The beneficial effects of the above implementation are:

[0083] Selecting a secure transmission protocol based on risk assessment makes the security of data transmission match the risk of the current network environment, improving the security and efficiency of data transmission. The working principle adopted is: the client selects the most appropriate secure transmission protocol based on the risk assessment of the current network environment and the security scores of different security protocols. This method allows the system to select the best transmission protocol under different security requirements and network conditions, ensuring data security and transmission efficiency.

[0084] In a preferred implementation, the integrated application in step f monitors the validity of the certification mark in real time and dynamically adjusts the verification frequency:

[0085] i. Check frequency F check Calculated according to the following formula: Where λ is the fundamental frequency, μ is the adjustment coefficient, and A risk is the risk assessment value of the application.

[0086] The beneficial effects of the above implementation are:

[0087] By dynamically adjusting the verification frequency of the certification mark validity, reasonable resource allocation and system performance optimization are achieved, while ensuring the real-time validity of the certification mark. The working principle adopted is: the integrated application dynamically calculates the verification frequency of the certification mark validity based on the risk assessment value and basic frequency of the application. When the risk is high, the verification frequency is increased to ensure security; when the risk is low, the verification frequency is reduced to reduce resource consumption and improve system performance.

[0088] Compared with the prior art, the present invention has the following beneficial effects:

[0089] The present invention adds information description and authentication of the application system account used in the unified authentication and authorization process, so that the application system can identify different multi-application accounts used by the user, so that the user does not need to switch the application account in the scenario where the unified user has multiple application accounts, which brings a better user experience; at the same time, since the application account accessed by the user is authenticated by the unified authentication system, unauthorized access can be avoided, ensuring the security of the system. The method has little intrusion on the application system, and compatibility can be achieved without making major adjustments to the application system that needs to be accessed.

[0090] For the case where a unified user has multiple application accounts in a certain application system, this method transforms the unified authentication service and allows the unified authentication service to authorize and manage the user's application account, which can reduce the process of users selecting the application account they need to use, optimize the user experience, and ensure the security of the entire system access. For example, the most common unified to-do in enterprise applications, when opening a to-do, a certain account must be used. With this method, users do not need to select an account again as in traditional implementation logic. At the same time, since the unified authentication system authenticates the user's access to the application account, unauthorized access can be avoided. BRIEF DESCRIPTION OF THE DRAWINGS

[0091] Figure 1 This is a logical timing diagram of the integrated method of the present invention when performing system authentication.

[0092] Figure 2 This is an interactive flow chart of the application account authentication process integrated into the present invention. DETAILED DESCRIPTION

[0093] In order to enable those skilled in the art to better understand the technical solution, the present invention is described in detail below in conjunction with embodiments. The description in this section is only exemplary and explanatory and should not have any limiting effect on the scope of protection of the present invention.

[0094] Embodiment 1:

[0095] like Figure 1-2As shown, a method for integrating a multi-account application system based on unified user authentication is provided. The method is based on a multi-account application system with unified user authentication. The system is composed of a user, a user client, a unified authentication service, an integrated application, and an integrated application. The integration implementation method based on the above system includes the following steps:

[0096] S01: The user opens the user client to access the integrated application, and the application system checks the user's login authorization status; if the user does not have login authorization, the application system prompts the user to authorize login through the login page of the user client;

[0097] S02: User authorization login. After the user completes the login through the unified authentication service, the user client opens the integrated application with the authentication authorization. Then the user client returns to the application interface from the login interface, and the user can use the integrated application.

[0098] S03: The user accesses the integrated application, and the user client opens the integrated application; the integrated application detects that the user has multiple accounts and does not have authentication authorization for the specified account; the integrated application wants the unified authentication service to request authentication of the user and issue login authorization, the unified authentication service checks whether the user has an associated application account, and the unified authentication service provides the integrated application with authentication authorization for the application account; the user client returns to the integrated application interface, and the user can access the integrated application.

[0099] Furthermore, taking the unified to-do list as an example, the interactive process of the integrated application account authentication process is as follows:

[0100] 1: The user uses the client to open the to-do URL of the integrated application (parameter: Access Token);

[0101] 1.1: The user client accesses the URL of the integrated application (passing parameter: Access Token);

[0102] 1.1.1: The integrated application checks the user's application account session information;

[0103] When the corresponding pending account has no login session,

[0104] 1.2: The integrated application redirects the user client to the authorization request (passing application ID, callback URL, application type, and application account);

[0105] 1.3: The user client requests authorization from the unified authentication service (parameters: application ID, callback URL, application type, application account);

[0106] When the user does not have an application account or does not have permission to access the application system,

[0107] 1.4: The unified authentication service redirects the user client to the callback URL (parameter: AuthorizationCode);

[0108] 1.5: The user client accesses the callback URL to the integrated application (error message: user is not authorized);

[0109] 1.6: The integrated application returns to the user client that the user does not have permission to access;

[0110] 1.7: The user client displays the user-unauthorized access interface to the user.

[0111] When a user has an application account,

[0112] 1.4a: The unified authentication service redirects the user client to the callback URL (passing parameter: AuthorizationCode);

[0113] 1.5a: The user client accesses the callback URL to the integrated application (passing parameter: Authorization Code);

[0114] 1.5a.1: The unified authentication service obtains the Access Token (Authorization Code) from the integrated application;

[0115] 1.5a.2: The unified authentication service returns the integrated application (parameter: Access Token);

[0116] 1.5a.3: The integrated application sets up the application login session;

[0117] 1.5a.4: The unified authentication service obtains user information from the integrated application (parameter: Access Token);

[0118] 1.5a.5: The unified authentication service returns (parameters: user and application account information) to the integrated application;

[0119] 1.6a: The integrated application returns the to-do URL interface to the user client;

[0120] 1.7a: The user client displays the to-do URL details interface to the user.

[0121] When the corresponding to-do account has a login session,

[0122] 1.2b: The integrated application returns the to-do interface to the user client;

[0123] 1.3b: The user client displays the to-do URL details interface to the user.

[0124] In specific operation, the implementation of the present invention is based on the Authorization Code mode of OAuth2.0. When the entire single sign-on is integrated in the application system (also called the resource system Resource Server), a set of authentication interaction processes for setting application account information is added, so that the integrated application system can also independently obtain the login authorization information of the application account, so that the user can use the application account to access the application without any perception.

[0125] The present invention also provides a computer program product for implementing the above method, the product comprising:

[0126] a. a storage medium for storing computer-readable instructions;

[0127] b. Computer-readable instructions for implementing the steps in the above method, including user identity authentication, authentication mark generation, authority determination, secure transmission and authentication mark verification.

[0128] The present invention also provides a computer system for implementing the above method, comprising:

[0129] a. at least one processor for executing instructions in a computer program product;

[0130] b. at least one memory for storing a computer program product;

[0131] c. Network communication module, used to realize data exchange between the client and the unified authentication service and the integrated application.

[0132] Embodiment 2:

[0133] 1. Technical solution overview

[0134] The present technical solution relates to a multi-account application system integration method based on unified user authentication, which aims to provide a safe, efficient and user-friendly access mechanism, allowing users to access multiple application systems through a single authentication process.

[0135] 2. Detailed description of the technical solution

[0136] User access request: The user initiates an access request to the integrated application through the client.

[0137] Automatic login detection: The client detects the user's login status and automatically sends a login request to the unified authentication service if the user is not logged in.

[0138] Authentication: The user performs identity authentication in the unified authentication service. After successful authentication, the service generates an authentication token containing user information and session identifier.

[0139] Permission determination: The unified authentication service determines the user's access rights to the application based on the user request and user information.

[0140] Secure transmission: The client carries the authentication mark to access the integrated application and uses a secure communication protocol (such as HTTPS) for data transmission.

[0141] Certification mark verification: The integrated application receives the certification mark and verifies the validity of the certification mark through interaction with the unified authentication service.

[0142] Account information association: The unified authentication service associates the user's account information with the authentication token and provides it to the client.

[0143] 3. Mathematical model of technical solution

[0144] Session timeout threshold optimization:

[0145] ΔT new =ΔT old ·(1-α·Var(B user ))

[0146] Where, ΔT old is the original timeout threshold, α is the adjustment coefficient, Var(B user ) is the variance of user behavior data.

[0147] This formula is used to dynamically adjust the session timeout threshold ΔT based on the variance Var(B user ). Variance is a statistic that measures the stability of user login frequency and usage time. By adjusting the coefficient α, the system can adjust the session timeout according to the consistency of user behavior, improve user experience and adapt to the needs of different users.

[0148] The behavior data of employee E1 on a normal working day is as follows:

[0149] The average login frequency is 5 times per day.

[0150] The average usage time is 30 minutes.

[0151] Formula application:

[0152] Using the formula ΔT new =ΔT old ·(1-α·Var(B user ))Adjust the session timeout threshold.

[0153] Set the original timeout threshold ΔT old =7200 seconds.

[0154] Adjustment coefficient α=0.05.

[0155] Assume that the variance of employee E1’s behavior data Var(B user )=2.45.

[0156] ΔT new =7200·(1-0.05·2.45)=7200·0.975=7002 seconds

[0157] Through the above calculation, the session timeout threshold of employee E1 is adjusted from 7200 seconds to 7002 seconds, reflecting the system's ability to extend the session time based on the stability of user behavior.

[0158] Dynamic calculation of the validity period of the certification mark:

[0159]

[0160] Among them, T base is the basic session time, w i is the weight coefficient, b i It is a rating item based on user behavior.

[0161] This formula is used to dynamically calculate the validity period TE of the certification mark based on the user behavior scoring item b i and weight coefficient w i This dynamic calculation allows the system to adjust the validity period of the certification mark based on the importance and frequency of user behavior, thereby providing a more personalized service.

[0162] The login behavior scores of employee E1 in different time periods are as follows:

[0163] Morning login: b1=100, weight w1=0.5.

[0164] Login in the afternoon: b2=50, weight w2=1.5.

[0165] Using the formula Calculate the validity period of the certification mark.

[0166] Basic session time T base =3600 seconds.

[0167] TE is calculated based on employee E1's behavioral score and weight.

[0168] Calculation process:

[0169] TE=3600+(0.5·100+1.5·50)=3600+(50+75)=4425 seconds

[0170] Through the above calculation, the validity period of employee E1's certification mark is set to 4425 seconds based on his behavior score and weight, which reflects the system's ability to dynamically adjust the validity period based on user behavior.

[0171] Permission weight distribution:

[0172]

[0173] Where m is the number of permission categories, f i is the scoring function, C i is the user's cumulative rating in this category.

[0174] This formula is used to determine the user's access rights to each application. app , based on the user's cumulative score C in different permission categories i And the scoring function f i This allows the system to grant access permissions based on the user's specific behavior and preferences.

[0175] Employee E1 has the following cumulative scores in two different app permission categories:

[0176] Application A has a score of C1=75.

[0177] Application B has a score of C2=50.

[0178] Using the formula Determine access permissions.

[0179] The scoring functions are set to f1(x)=x and f2(x)=1.2x.

[0180] P app =f1(75)+f2(50)=75+1.2·50=75+60=135

[0181] Through the above calculation, the total access permission score of employee E1 is 135, which reflects the system's ability to grant permissions based on the user's score in different application categories.

[0182] Security transmission protocol optimization:

[0183] S protocol = argmax(S i ·R i )

[0184] Among them, S i is the security score of protocol i, R i It is a risk assessment based on the current network environment.

[0185] This formula is used to select the most suitable secure transmission protocol S protocol , based on the protocol security score S i and risk assessment of the current network environment i This allows the system to select the best transport protocol based on current security requirements and network conditions.

[0186] Implementation method:

[0187] Choose between two different secure transport protocols:

[0188] The safety score of protocol 1 is S1=90, and the risk assessment is R1=0.8.

[0189] The safety score of protocol 2 is S2=80, and the risk assessment is R2=0.6.

[0190] Use formula S protocol = argmax(S i ·R i )Select a secure transmission protocol.

[0191] Calculate the products of the two protocols S1·R1 and S2·R2.

[0192] S protocol =argmax(90·0.8,80·0.6)=argmax(72,48)=72

[0193] Through the above calculations, protocol 1 is selected as the secure transmission protocol because it provides higher security and the ability to adapt to the current network environment.

[0194] Real-time monitoring of certification mark validity:

[0195]

[0196] Where λ is the base frequency, μ is the adjustment coefficient, and A risk is the risk assessment value of the application.

[0197] This formula is used to dynamically adjust the verification frequency F of the certification mark check , based on the risk assessment value A of the application risk and the base frequency λ. This allows the system to flexibly adjust the monitoring intensity according to security requirements and resource conditions.

[0198] Implementation method:

[0199] For the mail system in the enterprise, set the following parameters:

[0200] Fundamental frequency λ=1.

[0201] Risk Assessment Value A risk =0.2.

[0202] Using the formula Adjust the calibration frequency.

[0203] Set the adjustment coefficient μ=0.1.

[0204]

[0205] Through the above calculations, the authentication mark verification frequency of the mail system is adjusted to approximately once every 1.02 seconds, reflecting the system's ability to dynamically adjust the verification frequency based on the risk assessment of the application.

[0206] 4. Effect of technical solution

[0207] By implementing this technical solution, users can enjoy a smoother and more secure multi-application system access experience. System administrators can achieve more fine-grained access control while reducing system maintenance and support costs.

[0208] 5. Conclusion

[0209] This technical solution integrates the technical features of all the claims to form a comprehensive, coordinated and efficient multi-account application system integration method. This solution not only improves the user experience, but also enhances the security and manageability of the system, and is suitable for enterprise-level application environments that require high security and high availability.

[0210] Embodiment 3:

[0211] This embodiment aims to comprehensively demonstrate a multi-account application system integration method based on unified user authentication, which is suitable for improving the efficiency and security of user access to multiple application systems in an enterprise environment.

[0212] Take an enterprise as an example. The enterprise has deployed multiple internal application systems such as email, document management, and finance. Employees need to access all systems through a single login process.

[0213] 1. Detailed description of implementation steps

[0214] (1) User access request: An employee initiates an access request to the email system through a client.

[0215] (2) Automatic detection of login status: The client checks the locally stored session information. If it does not exist or has expired, it automatically sends a login request to the unified authentication service.

[0216] (3) Identity verification and authentication token generation: Employees enter their credentials into the unified authentication service. After successful service verification, an encrypted authentication token is generated, which contains the user's unique identifier and the session validity period TE.

[0217] (4) Dynamic permission determination: The service queries the permission database based on user requests and user information, and uses the permission weight allocation mechanism to determine user access rights.

[0218] (5) Secure transmission protocol selection: The client selects the most appropriate transmission protocol based on the risk assessment of the current network environment and the protocol security score.

[0219] (6) Client access with authentication token: The client accesses the mail system with authentication token through the selected security protocol.

[0220] (7) Real-time verification of authentication mark: The mail system receives the authentication mark and interacts with the unified authentication service to verify its validity.

[0221] (8) Account information association: The service associates the user's email system account information with the authentication token.

[0222] 2. Application and calculation of mathematical formulas

[0223] Session timeout threshold optimization:

[0224] ΔT new =ΔT old ·(1-α·Var(B user ))

[0225] Assume ΔT old =7200 seconds, α=0.05, Var(B user )=2.45, then:

[0226] ΔT new =7200·(1-0.05·2.45)=7002

[0227] Dynamic calculation of the validity period of the certification mark:

[0228] Assume T base =3600 seconds, w1=0.5, w2=1.5, b1=100, b2=50, then:

[0229] TE=3600+(0.5·100+1.5·50)=4500

[0230] Permission weight distribution:

[0231] Assume m = 2, f1(C1) = 75, f2(C2) = 50, then:

[0232] P app =75+50=125

[0233] Secure transmission protocol selection:

[0234] Assume S1=90,R1=0.8,S2=80,R2=0.6, then:

[0235] S protocol =argmax(90·0.8,80·0.6)=argmax(72,48)=72

[0236] Real-time monitoring of certification mark validity:

[0237] Assume λ = 1, μ = 0.1, A risk =0.2, then:

[0238]

[0239] 3. Data tables and technical effect verification

[0240]

[0241] It should be noted that, in this article, the terms: include, contain and any other variants are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. Specific examples are used in this article to illustrate the principle and implementation of the technical solution of the present invention. The above examples are only used to help understand the method of the present invention and its core idea. The above is only a preferred implementation of the present invention. It should be pointed out that due to the limitations of textual expression and the objective existence of infinite specific structures, for ordinary technicians in this technical field, without departing from the principle of the present invention, several improvements, modifications or changes can be made, and the above technical features can also be combined in an appropriate manner; these improvements, modifications, changes or combinations, or the direct application of the concept and technical solution of the present invention to other occasions without improvement, should be regarded as the protection scope of the present invention.

Claims

1. A method for integrating a multi-account application system based on unified user authentication, characterized in that: The following steps are involved: a. The user initiates an access request to the integrated application through the client; b. The client detects that the user is not logged in and automatically sends a login request to the unified authentication service; c. The user authenticates his / her identity in the unified authentication service. After successful authentication, the unified authentication service generates an authentication token containing user information and session identifier; d. The unified authentication service determines the user's access rights to the application based on the user request and user information; e. The client carries the authentication token to access the integrated application; f. The integrated application receives the authentication mark, verifies the validity of the authentication mark through interaction with the unified authentication service, and provides corresponding services based on the verification results; g. After the user's identity is successfully authenticated, the unified authentication service associates the user's account information with the authentication token and provides it to the client.

2. The method according to claim 1, characterized in that The specific implementation of the client detecting the user login status in step b is: i. The client checks the locally stored session information; ii. If the session information exists and has not expired, the user is considered to have logged in; iii. If the session information does not exist or has expired, it is considered that the user is not logged in.

3. The method according to claim 1, characterized in that The specific implementation of the unified authentication service generating the authentication mark in step c includes: i. Generate an authentication token containing the user's unique ID and session validity period based on the user's identity authentication result; ii. Encrypt the authentication mark to ensure the security of the transmission process.

4. The method according to claim 1, characterized in that: The specific implementation of the unified authentication service determining the user access rights in step d is as follows: i. Query the user permission database to obtain the user's access permission records for each application; ii. Determine whether the user has the right to access the application based on the application requested by the user and the user's permission record.

5. The method according to claim 1, characterized in that In step e, when the client carries the authentication mark to access the integrated application, the specific measures to ensure the secure transmission of the authentication mark are: i. Use secure communication protocols for data transmission; ii. The authentication mark is encrypted again to prevent it from being intercepted during transmission.

6. The method according to claim 1, characterized in that The specific implementation of the integrated application verifying the validity of the authentication mark in step f is: i. Verify the format and signature of the certification mark; ii. Communicate with the unified certification service in real time to confirm the current status and validity of the certification mark.

7. A multi-account application system integration system based on unified user authentication, applied to the method according to any one of claims 1 to 6, characterized in that: Includes the following components: a. Unified authentication service, used to handle user identity verification and the generation and verification of authentication marks; b. Client, used for interaction between users and integrated applications, including sending login requests and carrying authentication tokens; c. The integrated application is used to receive the client's request, verify the authentication mark, and provide corresponding services; d. Application system adapter, used to achieve adaptation and communication with unified authentication services without modifying the core logic of the existing application system.

8. The system according to claim 7, characterized in that The unified authentication service includes the following sub-modules: a. User identity verification module, used to verify the user's identity information; b. An authentication mark generation module for generating an authentication mark containing user information; c. Permission management module, used to manage user access rights to various applications; d. Application system account mapping module, used to map the user's unified authentication information to a specific application system account and realize transparent transmission of account information.

9. The method according to claim 1, characterized in that: When the client detects the user login status in step b, it also includes analyzing the user behavior pattern to optimize the session timeout threshold ΔT: The client collects user behavior data B user , including login frequency and usage duration; Update the session timeout threshold using the following formula: ΔT new =ΔT old ·(1-α·Var(B user )), where α is the adjustment coefficient, Var(B user ) is the variance of user behavior data, ΔT old It is the original session timeout threshold, which is the system default session timeout period.

10. The method according to claim 3, characterized in that: When the unified authentication service generates the authentication mark in step c, a dynamic algorithm based on user behavior is used: iii. The validity period TE of the certification mark is dynamically calculated according to the following formula: Where T base is the basic session time, w i is the weight coefficient, b i is a rating item based on user behavior, and n is the total number of rating items.

Images